> ## Content Index > Fetch the complete content index at: https://www.discernibleinc.com/llms.txt > Use this file to discover other available public pages before exploring further. # Trust Has No Release Date - URL: https://www.discernibleinc.com/trust-has-no-release-date/ - Published: 2026-11-09T19:31:27.000Z - Updated: 2026-11-09T19:31:27.000Z - Description: Security teams can handle an incident well and still look like they failed. Why many IR comms plans backfire and what to do instead. - Author: Melanie Ensign - Tags: Incident Response Communication isn't finished when a message ships.Before creating any communication assets, decide what stakeholders need to do now and what they should remember 6 months, and a year from now. Then build only the assets that serve those goals. Early this year, I was called in to help a client through a tense, high-profile situation. Within minutes of the first meeting, the team was drafting statements. They had a list of assets they wanted to produce: a holding statement, a customer email, an executive blog post, an FAQ, talking points for sales reps, etc. What they didn't have was any agreement on what those assets were supposed to accomplish. This client wasn't unusual. Most technical incident response plans are built this way. Open the communications section of a typical IR playbook and you'll find a list of deliverables and tasks, rather than objectives: draft the holding statement, notify customers, update the status page, and brief the board. I believe this format emerged primarily from two places. First, the technical runbook, where communication usually shows up as a few more checklist steps, and in a technical runbook, a step is done once it's executed. Second, legal review, where a notice succeeds when it goes out on time with the required elements. Proving compliance is a legitimate goal and it’s a job every legal notice has to do, but it’s not the only job of the notice because stakeholders care about other things too. Put the two together and a lot of teams started counting "sent" as "done." [The Identity Theft Resource Center ](https://www.idtheftcenter.org/wp-content/uploads/2026/07/ITRC-H1-2026-Data-Breach-Report.pdf?ref=discernibleinc.com)counted 471 million breach notices issued in the first half of 2026, and only 24 percent disclosed how the attack happened. Despite being sent to customers, notices are often written for regulators. They rarely start with the true recipients: *What do they need to do now? What do we want them to remember about our organization 6 months or a year from now?* ## **The shipping mindset** I’ve been calling this the shipping mindset (I don’t love this name so if you have a better idea, I’m all ears). A lot of teams inside an organization ship things. A code or product release has a date, and once it's out, the work moves on. Even the legal team has a ship date for new or changed policies; eager to stop staring at the same document. Communication doesn't work that way. Shaping, nurturing, and building productive relationships doesn’t happen in clean stages, and there is no release date for earning long-term trust. Picture a connect-the-dots puzzle with the numbers removed. The dots sit in a row that looks like a plan because you have a holding statement, customer email, FAQ, status page, and internal memo – all ready to go. But nothing strategic connects them, so no picture emerges. Your stakeholders are left to draw the lines themselves, and they don't always draw what you intended. ### **Everyone wants to be in the first meeting. Few stay for the work.** Communication kickoffs are crowded, in planning and in real incidents. Then attendance trails off, approvals stall, and assets ship late. A task list gives people a reason to show up, but it doesn't give anyone ownership of the outcome. Strategy calls are not therapy sessions. If you’re only here because you’re feeling anxious or don’t know what else to do, you’re in the way. There are better, more effective outlets for this kind of energy. ### **Without shared objectives, every reviewer treats the asset as their own.** Legal wants liability protection while product wants to reassure customers about the roadmap, and executives want to sound in control. Individually, each need is reasonable, but together they pull one draft in five directions, because no one can say what the draft is for. In [Sygnia's 2026 survey of 600 security leaders](https://www.sygnia.co/guides-and-tools/ciso-survey-2026/?ref=discernibleinc.com), 99 percent said they have a formal incident response plan. Yet 90 percent expect difficulty coordinating stakeholders during a significant incident, and 75 percent say legal and communications processes could slow decisions. So, plans exist, but the lines between the dots are missing. ### **Assets built on your own assumptions answer questions nobody asked.** My client had a business partner under public scrutiny and assumed its community would ask about the relationship. So the team drafted defensive assets explaining why it had chosen to work with that partner. Nobody cared until there was a defensive statement trying to justify it. That's a cost teams rarely anticipate. The organization assumed stakeholders would weigh the situation the way it did, so it prepared answers to concerns its audience didn't have. Stakeholders experience that disconnect as communication that seems out of touch, and sometimes as a brand-new worry. It's also why so many security teams burn out feeling like they have little to show for it. A team can contain an incident quickly, scope it accurately, and fix what failed, but if the communication is disconnected from what stakeholders care about, none of that effort is visible externally or even sometimes to other parts of the business. Stakeholders don't see a well-run response, but rather a confusing message, and they assume you got it wrong. ## **Communication isn't a stage** The deeper problem I see is where communication sits in the plan. Most playbooks treat it as the next stage in a production roadmap, the work that happens after the technical response. That makes communication a delivery function. It's really a relationship function. Your credibility as an organization is defined by how you treat ongoing relationships. It's a never-ending series of choices that communicate how you feel about your audience, which shapes how they feel about you in return. As I argued in[ The Sawtooth Problem](https://www.discernibleinc.com/the-sawtooth-problem/), security communication isn't an exceptional state that switches on during an incident because it’s not the incident that starts or ends that series of choices – it simply adds a few more dots to a line that was already there. So, what can we do instead? **1\. Move from an asset list to objectives over time.** Before you start drafting anything, write down what you want stakeholders to do right now and what you want them to remember a month, six months, and a year from now. (It's the same reverse-engineering we described in[ What Could Go Right](https://discernibleinc.com/blog/what-could-go-right?ref=discernibleinc.com).) Then choose the assets that serve those answers. Many items on your original list won't make the cut and that’s OK. This is something you can start right away: during your next quiet period, set a standing credibility goal for each audience relevant to your organization such as customers, employees, recruits, investors, partners, regulators, and peers. That goal is the line that connects every dot. **2\. Move from everyone reviews to owners review.** If you don't own the relationship or the consequences, you get an FYI, not a turn with the pen. Negotiate this in advance, because you won't win the argument under pressure (a lot of people try to regulate their discomfort during an incident by redlining drafts that are perfectly fine). If a reviewer has a legitimate need that doesn't fit an asset's job, they may need a different asset built for that goal. This is the hardest shift because it involves internal politics, but it also empties the crowded first meeting, because actual owners are the ones who stick around to do the work. **3\. Test your assumptions against the people who know the audience.** The people who manage these relationships every day know what stakeholders actually care about. Bring them in when you set objectives, before anyone drafts a defensive statement. When every asset has a job, stakeholders stop seeing a pile of disconnected messages and start seeing a team that knew what it was doing. --- ## Related Reading [*The Template Trap*](https://discernibleinc.com/blog/template-trap?ref=discernibleinc.com) [*Why Effective Security Communication Starts with Strategy, Not Translations*](https://www.discernibleinc.com/why-effective-security-communication-starts-with-strategy-not-translations/) [*When Less Is More: The Argument Dilution Effect*](https://discernibleinc.com/blog/when-less-is-more-argument-dilution-effect?ref=discernibleinc.com) [*Building Trust with Cross-Functional Teams*](https://discernibleinc.com/blog/building-trust-with-cross-functional-teams?ref=discernibleinc.com) [*Organizations Lack Sufficient Decision Frameworks*](https://discernibleinc.com/blog/organizations-lack-sufficient-decision-frameworks-to-expand-incident-response-options?ref=discernibleinc.com)